CVE-2026-55388

Name of the Vulnerable Software and Affected Versions piscina versions prior to 6.0.0-rc.2 piscina versions prior to 5.2.0 piscina versions prior to 4.9.3

Description Prototype pollution in the constructor and run() paths allows an attacker to control the filename option. When the options object lacks a filename property, the application reads it from the prototype chain. If Object.prototype.filename is polluted, the inherited value is passed to the worker threads.Worker import, enabling the execution of an attacker-controlled .mjs file within the worker.

Recommendations Update to version 6.0.0-rc.2. Update to version 5.2.0. Update to version 4.9.3.